From the UI, 'index=_audit action=alert_fired' works as expected. I'm not having any problems if I use action=search (from either my Python script or the UI). I applied 5.0.3 this morning and my symptoms have slightly changed. Now, when I run my script that starts the real time search I still get no results (as before), but if I go into 'Jobs' and click on the link to take me to that in progress search it shows events incrementing but I don't see the actual alert text displayed. With 5.0.2 I would see the text. ... View more